A CISO asks the network team to design a network that assumes breach. Which architecture element is most aligned with this philosophy?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — when you assume breach, you need to stop attackers from moving around inside. Internal segmentation firewalls restrict east-west traffic between segments, which limits lateral movement. Bigger perimeter firewalls won't help once they're already inside.
Full Explanation
The correct choice is internal segmentation firewalls that restrict east-west traffic between segments. This aligns with assume-breach architecture because it focuses on limiting lateral movement once an attacker is inside. The larger perimeter firewall with higher throughput is wrong because it only addresses north-south traffic and does not limit internal lateral movement. Increasing the perimeter IDS signature update frequency is wrong because it helps detection but does not limit what an attacker can do after breach. Adding a second perimeter DMZ with duplicate firewall rules is wrong because it addresses perimeter redundancy, not internal breach containment.